Vikas Thakur / / 11 min readA $3 million turnover threshold exempts most small businesses from the Privacy Act. Cosmetic clinics and dental practices are not among them, because section 6D(4)(b) removes the exemption for any business that provides a health service and holds health information.
Vikas Thakur / / 10 min readHealth service providers reported 225 data breach notifications in 2025, more than any other sector, according to the OAIC. Here is where a clinic or dental practice website creates that exposure and what to fix in the build.
Vikas Thakur / / 13 min readSection 16C of the Privacy Act makes your clinic accountable for what an overseas vendor does with a patient's data, and APP 8 sets the reasonable steps you must take before that disclosure happens. This guide breaks the rule into the vendor categories a clinic or dental practice actually runs and what each one needs on file to satisfy an exception.
Vikas Thakur / / 12 min readIn June 2026 the OAIC found two Australian health service providers breached the Privacy Act by running tracking pixels without valid consent. A cosmetic clinic or cosmetic dental practice runs the same pixels on the same kind of pages, so the same rules apply.
Vikas Thakur / / 8 min readHealth service providers, the category dental practices fall under, accounted for 121 of the 595 data breaches reported to Australia's privacy regulator in the second half of 2024, 20% of the total. It was the top sector for the third straight reporting period.